fix(afs): require zero locktime for the nSequence path

[evanlinjin]

Description

Fixes #65 (comment) — point 2 of #73 (comment).

The nSequence path exists so the tx resembles an off-chain settlement spending a timelock path, and those carry nLockTime = 0 with a CSV-driven sequence.

#65 removed the tx.lock_time = LockTime::ZERO that path used to perform — correctly, since it regressed input CLTVs — but added no precondition in its place. So a tx whose locktime is already pinned, by an input's CLTV or by min_locktime, can come out with both a near-tip locktime and a confirmation-depth sequence. That matches neither an ordinary wallet spend nor a contract close: a third fingerprint, worse than either branch alone.

The path is only coherent at lock_time == 0, so make that a precondition:

let must_use_locktime = tx.lock_time != LockTime::ZERO
    || taproot_inputs.is_empty()
    || inputs.iter().any(|input| { /* ... */ });

Changelog notice

Fixed:
- Anti-fee-sniping only takes the `nSequence` path when `tx.lock_time` is zero. A locktime pinned by an input's CLTV or by `min_locktime` now always takes the `nLockTime` path.

Before submitting

• I followed the contribution guidelines
• This PR breaks the existing API

🤖 Generated with Claude Code

[ValuedMammal]

tACK e05146e